@intentic/sandbox-contract 1.317.0 → 1.319.0

package/src/ids/project-dir.ts

@@ -0,0 +1,70 @@
+import { MEMORY_FILE, PUBLIC_DIR, REFERENCE_DIR, WORKSPACE_ROOT } from "@intentic/constants";
+import { STARTER_REPO } from "../state/starter.js";
+
+// A PROJECT SANDBOX is made for one folder on the owner's computer, synced live into `/work/<name>` rather than into
+// /work itself: the workspace root is the daemon's own, where it keeps its state, seeds its starter repo and serves
+// `public/` to anyone with a link. `<name>` is derived from the folder's name once, on the owner's side, and every
+// later reader (the sync agent, `ic`, the daemon) only validates it. `_sandbox/ic/src/sandbox/project_dir.rs` holds the
+// validation again for the host side; `project-dir.fixture.json` is the one set of cases both run.
+
+// Top-level names the daemon treats as its own, so a project can never land on one: the public outbox, the reference
+// shelf, the starter repo seeded on first boot, the root repo's id and the three repo roles repo discovery refuses
+// (`_sandbox/sandbox/src/workspace/layout/repo-discovery.ts`), and the standing-instructions file it writes. Then the
+// names every walk of the workspace skips at any depth (@intentic/workspace-ignore IGNORED_DIRS, and the private file
+// the git scopes leave out), where a project would sync and never be seen; the daemon's tests hold this list to that
+// one. Everything else of either kind starts with a dot (`.intentic`, `.venv`), which the name rule below refuses.
+export const RESERVED_PROJECT_DIR_NAMES: readonly string[] = [
+    PUBLIC_DIR,
+    REFERENCE_DIR,
+    STARTER_REPO,
+    "root",
+    "intent",
+    "desired-state",
+    "app",
+    MEMORY_FILE,
+    "node_modules",
+    "dist",
+    "venv",
+    "claude.json",
+];
+
+// Starts alphanumeric, so no dot-file and no leading dash an argv could read as a flag; no separator, so it is always
+// one path segment; bounded, since it also names a git dir and a folder in every view of the workspace.
+const PROJECT_DIR_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const PROJECT_DIR_NAME_MAX = 64;
+
+// Used when nothing of the folder's name survives the slug (a name in another script, or only punctuation).
+const FALLBACK_NAME = "project";
+
+// Combining marks, which NFKD splits off an accented letter.
+const COMBINING_MARKS = /[\u0300-\u036f]/g;
+
+export const isProjectDirName = (name: string): boolean => PROJECT_DIR_NAME.test(name) && !RESERVED_PROJECT_DIR_NAMES.includes(name);
+
+// The workspace-relative name for a folder the owner picked, always one `isProjectDirName` accepts. Accents are folded
+// to their base letter first, so `Café` keeps its `e` rather than losing it to a dash.
+export const projectDirNameFor = (folderBasename: string): string => {
+    const slug = folderBasename
+        .normalize("NFKD")
+        .replace(COMBINING_MARKS, "")
+        .replace(/[^A-Za-z0-9._-]+/g, "-")
+        .replace(/-{2,}/g, "-")
+        .replace(/^[._-]+/, "")
+        .slice(0, PROJECT_DIR_NAME_MAX)
+        .replace(/[.-]+$/, "");
+    const name = slug === "" ? FALLBACK_NAME : slug;
+    return RESERVED_PROJECT_DIR_NAMES.includes(name) ? `${name}-project` : name;
+};
+
+// Where a project folder lands in the sandbox, and the name back out of such a path: exactly `<root>/<name>`, anything
+// else (a deeper path, a trailing slash, a reserved name) is not a project dir.
+export const projectRemoteDir = (name: string): string => `${WORKSPACE_ROOT}/${name}`;
+
+export const projectDirNameOf = (remoteDir: string, root: string = WORKSPACE_ROOT): string | undefined => {
+    const prefix = `${root}/`;
+    if (!remoteDir.startsWith(prefix)) {
+        return undefined;
+    }
+    const name = remoteDir.slice(prefix.length);
+    return isProjectDirName(name) ? name : undefined;
+};

package/src/index.ts

@@ -58,6 +58,8 @@ export { choresContract } from "./contracts/chores.contract.js";
 export { ciContract } from "./contracts/ci.contract.js";
 export {
     endpointsContract,
+    type LocalModelDevice,
+    LocalModelDeviceSchema,
     LocalModelFitSchema,
     type LocalModelFitResponse,
     type LocalModelGpu,
@@ -86,6 +88,7 @@ export { issuesContract } from "./contracts/issues.contract.js";
 export { logsContract } from "./contracts/logs.contract.js";
 export { REQUEST_ID_HEADER } from "./protocol/request-id.js";
 export * from "./protocol/edge-verdict.js";
+export * from "./protocol/vitals.js";
 export { loopsContract } from "./contracts/loops.contract.js";
 export { panelsContract } from "./contracts/panels.contract.js";
 export { portsContract } from "./contracts/ports.contract.js";
@@ -111,6 +114,7 @@ export * from "./events/agent-events.js";
 export * from "./events/agent-words.js";
 export * from "./events/requests.js";
 export * from "./events/resume.js";
+export * from "./events/sandbox-notice.js";
 export * from "./events/system-events.js";
 export * from "./events/transcript.js";
 export * from "./events/land-breakage.js";
@@ -139,7 +143,6 @@ export * from "./state/history-state.js";
 export * from "./state/fix-stance.js";
 export * from "./state/landed-commit.js";
 export * from "./state/fix-attempt-plan.js";
-export * from "./state/red-streak.js";
 // Provider vocabulary bottom-up: agent-runtimes, provider-specs, agent-catalog; three modules since the dependency
 // points one way.
 export * from "./models/agent-runtimes.js";
@@ -152,6 +155,7 @@ export * from "./policy/safety-policy.js";
 export * from "./policy/reserved-servers.js";
 export * from "./policy/credential-material.js";
 export * from "./policy/capability-secrets.js";
+export * from "./policy/secret-hosts.js";
 export * from "./ids/conversation-ids.js";
 export * from "./text/documents.js";
 export * from "./protocol/host-protocol.js";
@@ -161,6 +165,7 @@ export * from "./protocol/runner-protocol.js";
 export * from "./protocol/listener-protocol.js";
 export * from "./protocol/container-requirements.js";
 export * from "./ids/hostnames.js";
+export * from "./ids/project-dir.js";
 export * from "./policy/overlay-lint.js";
 export * from "./models/model-label.js";
 export * from "./models/model-order.js";
@@ -200,6 +205,7 @@ export * from "./schemas/git/git.js";
 export * from "./schemas/git/git-history.js";
 export * from "./schemas/history.js";
 export * from "./schemas/hosts.js";
+export * from "./schemas/loopback-catch.js";
 export * from "./schemas/intentic.js";
 export * from "./schemas/inventory.js";
 export * from "./schemas/issues.js";
@@ -239,7 +245,6 @@ export * from "./schemas/webext.js";
 export * from "./schemas/workflows.js";
 export * from "./schemas/workspace/workspace-repos.js";
 export * from "./schemas/workspace/workspace-search.js";
-export * from "./schemas/workspace/push-checks.js";
 export * from "./schemas/workspace/workspace-setup.js";
 export * from "./schemas/workspace/workspace-tree.js";
 export * from "./state/arrival.js";
@@ -308,8 +313,12 @@ export const SANDBOX_ROUTES: readonly ContractRoute[] = contractRoutes(sandboxCo
 export const SANDBOX_ROUTE_NAMES: readonly string[] = SANDBOX_ROUTES.map((route) => route.name);
 
 // Each route's shape, for the failure names alone can't describe: a route both builds have, but whose payload only one
-// expects. Computed once at load, since it's too expensive to repeat per connection.
-export const SANDBOX_ROUTE_SHAPES: Readonly<Record<string, string>> = routeShapes(sandboxContract);
+// expects. Computed on the first ask and kept, since it's too expensive to repeat per connection — and too expensive to
+// pay at load: turning every route's schemas into JSON Schema was a third of a second of a phone's startup at 4× CPU
+// throttle, for a comparison a browser only makes when it has a disagreement to explain (the version card). The daemon
+// asks on its first hello.
+let fingerprints: Readonly<Record<string, string>> | undefined;
+export const sandboxRouteFingerprints = (): Readonly<Record<string, string>> => (fingerprints ??= routeShapes(sandboxContract));
 
 // The contract route a concrete browser request belongs to, bound to this build's route table.
 export const sandboxRouteName = (method: string, pathWithQuery: string): string | undefined =>

package/src/models/agent-catalog.test.ts

@@ -126,6 +126,9 @@ test("the ceiling has nothing to disclose; a floor names what it lacks", () => {
     expect(grokCaps.steering).toBe(false);
     expect(grokCaps.isolation).toBe("cwd");
     expect(limitationsOf(grokCaps).length).toBeGreaterThan(0);
+    // The turn's remote servers, as Codex takes them: mounted on the shared OpenCode server per conversation.
+    expect(grokCaps.mcp).toBe("http");
+    expect(limitationsOf(grokCaps)).toContain("MCP servers only, none of the daemon's own tools, no plugins");
 
     const acpCaps = capabilitiesOf("some-installed-agent", "native");
     expect(acpCaps.mcp).toBe("http");
@@ -178,7 +181,10 @@ test("the safety axes disclose the middle answer differently from the floor", ()
 
     expect(codexCaps.rulebook).toBe("approval");
     expect(piCaps.rulebook).toBe("none");
-    expect(grokCaps.rulebook).toBe("refuse-only");
+    expect(grokCaps.rulebook).toBe("approval");
+    // A hold parks on a card now that the turn's watchdog is held while it waits, so nothing says it cannot hold.
+    expect(limitationsOf(grokCaps)).toContain("command rules apply only to calls this agent raises");
+    expect(limitationsOf(grokCaps)).not.toContain("command rules can refuse but not hold");
 
     expect(limitationsOf(claudeCaps).join(" ")).not.toContain("command rules");
     expect(limitationsOf(claudeCaps).join(" ")).not.toContain("stored secrets");

package/src/models/agent-runtimes.ts

@@ -102,14 +102,15 @@ export const CODEX: AgentCapabilities = {
     secrets: "none",
 };
 
-// OpenCode (the Grok runtime): its own agentic loop, its own tools, allow-all permissions. Takes a model id, a prompt
-// and one system message of ours; no effort scale, no tools of ours, no command list.
+// OpenCode (the Grok runtime): its own agentic loop and tools, with the turn's remote MCP servers mounted on the shared
+// server per conversation. Takes a model id, a prompt and one system message of ours; no effort scale, no command list.
 export const OPENCODE: AgentCapabilities = {
     runtime: "opencode",
     steering: false,
     permissions: "plan",
     questions: false,
-    mcp: "none",
+    // Added at runtime under the conversation's own names, each prompt showing its session only its own (opencode-mcp.ts).
+    mcp: "http",
     execution: ["shell"],
     effort: false,
     fastMode: false,
@@ -121,8 +122,9 @@ export const OPENCODE: AgentCapabilities = {
     // `system` on the prompt body, per message; adds to OpenCode's own prompt, with no seam to replace it.
     instructions: "append",
     skillDiscovery: "prompt",
-    // refuse-only for its inactivity watchdog, not its protocol: a paused approval reads as a stalled turn.
-    rulebook: "refuse-only",
+    // OpenCode raises its permission asks for the commands its config names; the daemon answers from the rulebook, a
+    // hold parked on a card while the turn's inactivity watchdog is held.
+    rulebook: "approval",
     secrets: "none",
 };
 

package/src/models/model-roles.ts

@@ -71,7 +71,7 @@ export const MODEL_ROLES = [
     {
         id: "pipeline-fix",
         label: "Pipeline fixes",
-        blurb: "The agent started by Fix on a red pipeline.",
+        blurb: "The agent started by Fix on a failed pipeline.",
         kind: "run",
         trigger: "pressed",
         icon: "wave-pulse",
@@ -108,14 +108,6 @@ export const MODEL_ROLES = [
         trigger: "pressed",
         icon: "list-check",
     },
-    {
-        id: "pre-push-fix",
-        label: "Pre-push fixes",
-        blurb: "The fix proposed when a check fails on the way to a push.",
-        kind: "run",
-        trigger: "pressed",
-        icon: "cloud-upload",
-    },
     {
         // Pressed trigger: the owner's approval click starts this turn; the queue between is just machinery.
         id: "approval-queue",

package/src/policy/command-classes.test.ts

@@ -40,6 +40,22 @@ describe("git.destructive", () => {
     test("a -f belonging to the next command in a pipeline is not a force-push", () => {
         expect(classify("git push origin main | grep -f patterns.txt")).not.toContain("git.destructive");
     });
+
+    test("deleting a checkout's .git, or re-initialising the folder it stands in, cuts it off from its history", () => {
+        for (const command of ["rm .git", "rm -f .git", "rm -rf ./.git", "rm -rf tabularium/.git", "rm .git && git init -b main"]) {
+            expect(classify(command), command).toContain("git.destructive");
+        }
+        for (const command of ["git init", "git init .", "git init -b main", "git init --initial-branch main -q ."]) {
+            expect(classify(command), command).toContain("git.destructive");
+        }
+        expect(marked("cd /work && rm .git && git init -b main", "git.destructive")).toEqual(["rm .git", "git init -b main"]);
+    });
+
+    test("a new project's git init, and files that merely start with .git, are left alone", () => {
+        for (const command of ["git init new-project", "git init -b main tools/cli", "rm .gitignore", "rm -f .github/old.yml", "rm .gitmodules"]) {
+            expect(classify(command), command).not.toContain("git.destructive");
+        }
+    });
 });
 
 describe("files.destructive", () => {
@@ -72,6 +88,27 @@ describe("files.destructive", () => {
         }
     });
 
+    test("find deleting what it walks, or handing it to rm, is the same delete as rm -rf", () => {
+        for (const command of [
+            "find /home/x/PROJECT/cerberus-worktrees/m1-a -depth -delete",
+            "find build -name '*.o' -delete",
+            "find . -type d -name node_modules -exec rm -rf {} +",
+            "find dist -exec /bin/rm -f {} \\;",
+            "find tmp -execdir rm {} \\;",
+            "find . -name '*.log' -print0 | xargs -0 rm -f",
+            "ls old | xargs rm",
+        ]) {
+            expect(classify(command), command).toContain("files.destructive");
+        }
+        expect(marked("find build -name '*.o' -delete; echo done", "files.destructive")).toEqual(["find build -name '*.o' -delete"]);
+    });
+
+    test("a find that only lists, and an xargs that runs something else, pass", () => {
+        for (const command of ["find . -name '*.ts'", "find . -newer deleted.txt -print", "find src -exec grep -l rm {} +", "ls | xargs wc -l"]) {
+            expect(classify(command), command).not.toContain("files.destructive");
+        }
+    });
+
     test("a script that deletes one file, or nothing, is not recursive deletion", () => {
         for (const code of ['fs.unlinkSync("tmp.txt")', 'await fs.promises.rm("tmp.txt")', "const rmq = queue.rm(job)"]) {
             expect(classify(code), code).not.toContain("files.destructive");
@@ -113,6 +150,8 @@ describe("system.destructive", () => {
             "rm -rf C:\\",
             'fs.rmSync("/", { recursive: true, force: true })',
             'rimraf("/work")',
+            "find / -delete",
+            "find /home -type f -delete",
         ]) {
             expect(classify(command), command).toContain("system.destructive");
         }

package/src/policy/command-classes.ts

@@ -375,6 +375,66 @@ const recursiveForceRms = (command: string): CommandSpan[] =>
         .filter((invocation) => invocation.recursive && invocation.force)
         .map((invocation) => invocation.span);
 
+// The same tree delete spelled without `rm -rf`: `find` deleting what it walks, or handing each hit to `rm`, and a list
+// piped into `rm` through xargs. An agent told `rm -rf` needs a card reaches for exactly these.
+const FIND_INVOCATION = /\bfind\s+([^|;&\n]*)/g;
+const FIND_DELETES = /\s(?:-delete\b|-exec(?:dir)?\s+(?:[^\s|;&]*\/)?rm\b)/;
+const XARGS_RM = /\bxargs\b[^|;&\n]*?\s(?:[^\s|;&]*\/)?rm\b/g;
+
+interface FindDelete {
+    // The paths find starts walking from: the words before its first expression (`-name`, `(`, `!`).
+    readonly starts: readonly string[];
+    readonly span: CommandSpan;
+}
+
+const parseFindDeletes = (command: string): FindDelete[] =>
+    [...command.matchAll(FIND_INVOCATION)].flatMap((invocation) => {
+        const args = invocation[1] as string;
+        if (!FIND_DELETES.test(` ${args}`)) {
+            return [];
+        }
+        const words = args.trim().split(/\s+/);
+        const expression = words.findIndex((word) => /^[-(!]/.test(word));
+        const starts = (expression === -1 ? words : words.slice(0, expression)).filter((word) => word !== "").map(unquote);
+        return [{ starts, span: { start: invocation.index, end: invocation.index + invocation[0].trimEnd().length } }];
+    });
+
+const findAndXargsDeletes = (command: string): CommandSpan[] => [
+    ...parseFindDeletes(command).map((found) => found.span),
+    ...spansOf([XARGS_RM], command),
+];
+
+// What cuts a checkout off from its repository's history: deleting its `.git` (for a worktree, a one-line pointer
+// whose loss strands every commit the checkout was reading), or `git init` over the folder it stands in, which makes
+// a standalone repository sharing nothing with the one it came from. A `git init <new-dir>` for a new project is not
+// this, so only an init of the current folder counts.
+const GIT_POINTER = /(?:^|[/\\])\.git[/\\]?$/;
+const GIT_INIT = /\bgit\s+init\b([^|;&\n]*)/g;
+const GIT_INIT_VALUED = /^(?:-b|--initial-branch|--template|--separate-git-dir|--object-format|--ref-format)$/;
+
+const initsHere = (args: string): boolean => {
+    const words = args.trim().split(/\s+/).filter((word) => word !== "");
+    const operands: string[] = [];
+    for (let index = 0; index < words.length; index += 1) {
+        const word = words[index] as string;
+        if (GIT_INIT_VALUED.test(word)) {
+            index += 1;
+        } else if (!word.startsWith("-")) {
+            operands.push(unquote(word));
+        }
+    }
+    return operands.every((operand) => operand === "." || operand === "./");
+};
+
+const checkoutUnlinks = (command: string): CommandSpan[] => [
+    ...parseRm(command)
+        .filter((invocation) => invocation.operands.some((operand) => GIT_POINTER.test(operand)))
+        .map((invocation) => invocation.span),
+    ...[...command.matchAll(GIT_INIT)]
+        .filter((invocation) => initsHere(invocation[1] as string))
+        .map((invocation) => ({ start: invocation.index, end: invocation.index + invocation[0].trimEnd().length })),
+];
+
 // A recursive delete aimed at a root, in either spelling the gate is handed (shell or script). Which targets count as
 // roots is the locus's answer.
 const rootDeletes = (program: string, locus: CommandLocus): CommandSpan[] => [
@@ -384,6 +444,9 @@ const rootDeletes = (program: string, locus: CommandLocus): CommandSpan[] => [
     ...nodeDeleteTargets(program)
         .filter((delete_) => isRootTarget(delete_.target, locus))
         .map((delete_) => delete_.span),
+    ...parseFindDeletes(program)
+        .filter((found) => found.starts.some((start) => isRootTarget(start, locus)))
+        .map((found) => found.span),
 ];
 
 // The g twins, built once at load: a card is minted per command held, classify runs per command typed.
@@ -434,10 +497,10 @@ const credentialReads = (command: string, context: CommandContext): CommandSpan[
 
 // One function per class; empty means the command is not in it, so membership and evidence are the same walk.
 const MATCHES: Readonly<Record<CommandClass, (command: string, context: CommandContext) => CommandSpan[]>> = {
-    "git.destructive": (command) => spansOf(GIT_DESTRUCTIVE_G, command),
+    "git.destructive": (command) => [...spansOf(GIT_DESTRUCTIVE_G, command), ...checkoutUnlinks(command)],
     // The only class that can answer "not here": in its own copy a conversation's checkout is its own to move.
     "git.branch-switch": (command, context) => (context.ownCheckout === true ? [] : spansOf(GIT_BRANCH_SWITCH_G, command)),
-    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command)],
+    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command), ...findAndXargsDeletes(command)],
     "system.destructive": (command, context) => [...spansOf(BLOCK_DEVICE_G, command), ...rootDeletes(command, context.locus)],
     "container.state": (command) => spansOf(CONTAINER_STATE_G, command),
     "secrets.access": credentialReads,
@@ -489,6 +552,8 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "git clean -f" },
         { code: "git branch -D" },
         { code: "git filter-branch" },
+        { code: "rm .git", qualifier: "any flags: a checkout's link to its history" },
+        { code: "git init", qualifier: "only in the current folder, which may already be a checkout" },
     ],
     "git.branch-switch": [
         { code: "git switch <branch>" },
@@ -498,6 +563,8 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "rm -rf <path>" },
         { code: "fs.rm(<path>, { recursive: true })", qualifier: "also rmSync, rmdir, rmdirSync" },
         { code: "rimraf(<path>)" },
+        { code: "find <path> -delete", qualifier: "also -exec rm and -execdir rm" },
+        { code: "xargs rm" },
     ],
     "system.destructive": [
         { code: "mkfs" },
@@ -507,7 +574,7 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "dd of=/dev/…" },
         { code: "shred /dev/…" },
         { code: "> /dev/sda" },
-        { code: "rm -rf /", qualifier: "only when the target is a root, listed below" },
+        { code: "rm -rf /", qualifier: "also find / -delete; only when the target is a root, listed below" },
     ],
     "container.state": [
         { code: "docker volume rm", qualifier: "also remove, prune, and podman for any of these" },

package/src/policy/safety-policy.ts

@@ -64,6 +64,15 @@ export const COMMAND_RULE_CATALOG: readonly CommandRule[] = CommandClassSchema.o
 export const CommandJudgeModeSchema = z.enum(["off", "watch", "on"]);
 export type CommandJudgeMode = z.infer<typeof CommandJudgeModeSchema>;
 
+// What an agent's own project-dependency install (`pnpm add`, `npm install`, `uv sync`) does, one answer for every
+// turn. Where the install lands is the sandbox's business, not the owner's: an isolated turn installs into its own copy
+// and a main-tree turn takes the install lane the daemon's own installs take. This only says whether a person is asked:
+// - automatic: it runs
+// - ask: a card in the turn; the turn waits on that one call, and "allow for this conversation" stops the asking
+// - never: refused; the manifest change still lands and the daemon installs it then
+export const ProjectInstallModeSchema = z.enum(["automatic", "ask", "never"]);
+export type ProjectInstallMode = z.infer<typeof ProjectInstallModeSchema>;
+
 // What the judge answers, one instruction per verdict:
 // - allow: run it, say nothing, the ordinary answer for a triage false positive
 // - ask: raise the card; the only path to a person, meant to be rare
@@ -122,6 +131,7 @@ Ask me before:
 
 - publishing or releasing anything (npm publish, a GitHub release, a container push);
 - force-pushing, hard-resetting or otherwise discarding commits that are not this turn's own work;
+- deleting a checkout's \`.git\` or running \`git init\` in a folder that already is one: in a worktree that cuts it off from my workspace's history, and its work can no longer come back to me;
 - moving a checkout onto another branch (\`git checkout <branch>\`, \`git switch\`) — you only ever see this for a tree that is mine as well as yours, never for a copy of your own, so the worktree paragraph above does not cover it;
 - sending a credential anywhere outside this container.
 

package/src/policy/secret-hosts.test.ts

@@ -0,0 +1,89 @@
+import { hostAllowed, hostMatches, normalizeHost, normalizeHostPattern, tightensHostGuard } from "./secret-hosts.js";
+
+// The pattern a person writes against the host a use would reach. Every boundary a limit turns on is pinned by value:
+// the apex a wildcard leaves out, the look-alike that only shares a suffix, and which edits take hosts away.
+
+describe("normalizeHostPattern", () => {
+    it("reads what a person types or pastes as the host it means", () => {
+        expect(normalizeHostPattern("  API.GitHub.com. ")).toBe("api.github.com");
+        expect(normalizeHostPattern("https://api.github.com/user?per_page=5")).toBe("api.github.com");
+        expect(normalizeHostPattern("api.github.com:443")).toBe("api.github.com");
+        expect(normalizeHostPattern("*.githubusercontent.com")).toBe("*.githubusercontent.com");
+        expect(normalizeHostPattern("localhost")).toBe("localhost");
+        expect(normalizeHostPattern("10.0.0.2")).toBe("10.0.0.2");
+    });
+
+    it("refuses what is not one host or one domain's hosts", () => {
+        expect(normalizeHostPattern("*")).toBeUndefined();
+        expect(normalizeHostPattern("*.com")).toBeUndefined();
+        expect(normalizeHostPattern("api.*.com")).toBeUndefined();
+        expect(normalizeHostPattern("api.github.com/user")).toBeUndefined();
+        expect(normalizeHostPattern("user@api.github.com")).toBeUndefined();
+        expect(normalizeHostPattern("-bad.example.com")).toBeUndefined();
+        expect(normalizeHostPattern("")).toBeUndefined();
+        expect(normalizeHostPattern(`${"a".repeat(64)}.com`)).toBeUndefined();
+    });
+});
+
+describe("normalizeHost", () => {
+    it("takes a plain host or address and nothing shaped like a pattern or a stray token", () => {
+        expect(normalizeHost("API.github.com.")).toBe("api.github.com");
+        expect(normalizeHost("*.github.com")).toBeUndefined();
+        expect(normalizeHost("[::1]")).toBeUndefined();
+        expect(normalizeHost("api.github.com\u0001")).toBeUndefined();
+        expect(normalizeHost("$host")).toBeUndefined();
+    });
+});
+
+describe("hostMatches", () => {
+    it("matches an exact host only to itself", () => {
+        expect(hostMatches("api.github.com", "api.github.com")).toBe(true);
+        expect(hostMatches("api.github.com", "github.com")).toBe(false);
+        expect(hostMatches("github.com", "api.github.com")).toBe(false);
+    });
+
+    it("matches a wildcard to every host under the domain, at any depth, and not to the domain itself", () => {
+        expect(hostMatches("*.github.com", "api.github.com")).toBe(true);
+        expect(hostMatches("*.github.com", "a.b.github.com")).toBe(true);
+        expect(hostMatches("*.github.com", "github.com")).toBe(false);
+    });
+
+    it("does not match a host that merely ends in the same letters", () => {
+        expect(hostMatches("*.github.com", "evilgithub.com")).toBe(false);
+        expect(hostMatches("*.github.com", "github.com.evil.example")).toBe(false);
+    });
+
+    it("allows a host any one pattern in the list matches", () => {
+        expect(hostAllowed(["api.github.com", "*.githubusercontent.com"], "raw.githubusercontent.com")).toBe(true);
+        expect(hostAllowed(["api.github.com", "*.githubusercontent.com"], "evil.example")).toBe(false);
+        expect(hostAllowed([], "api.github.com")).toBe(false);
+    });
+});
+
+describe("tightensHostGuard", () => {
+    const on = (...hosts: string[]) => ({ guard: true, hosts });
+    const off = (...hosts: string[]) => ({ guard: false, hosts });
+
+    it("reads turning the guard on as tightening, whatever the list, and turning it off as loosening", () => {
+        expect(tightensHostGuard(undefined, on("api.github.com"))).toBe(true);
+        expect(tightensHostGuard(off("api.github.com"), on())).toBe(true);
+        expect(tightensHostGuard(on("api.github.com"), off("api.github.com"))).toBe(false);
+        expect(tightensHostGuard(undefined, off())).toBe(true);
+        expect(tightensHostGuard(off(), off("evil.example"))).toBe(true);
+    });
+
+    it("reads taking a host off a guarded list as tightening, down to none, and adding one as loosening", () => {
+        expect(tightensHostGuard(on("api.github.com", "github.com"), on("github.com"))).toBe(true);
+        expect(tightensHostGuard(on("api.github.com"), on())).toBe(true);
+        expect(tightensHostGuard(on("api.github.com"), on("api.github.com", "evil.example"))).toBe(false);
+        expect(tightensHostGuard(on(), on("api.github.com"))).toBe(false);
+        expect(tightensHostGuard(on("api.github.com"), on("api.github.com"))).toBe(true);
+    });
+
+    it("counts a host or a deeper wildcard under a held wildcard as covered, and the domain itself as not", () => {
+        expect(tightensHostGuard(on("*.github.com"), on("api.github.com"))).toBe(true);
+        expect(tightensHostGuard(on("*.github.com"), on("*.api.github.com"))).toBe(true);
+        expect(tightensHostGuard(on("*.github.com"), on("github.com"))).toBe(false);
+        expect(tightensHostGuard(on("api.github.com"), on("*.api.github.com"))).toBe(false);
+    });
+});

package/src/policy/secret-hosts.ts

@@ -0,0 +1,73 @@
+// Which hosts a stored secret may be sent to: an owner's list per secret, matched against the hosts one use would reach.
+// Shared by the daemon's check, its routes and the Secrets view, so the three cannot disagree on what a pattern means.
+// A list names hosts, never ports or paths: the question it answers is who receives the value, not which door.
+
+// One DNS label: letters, digits and inner hyphens, at most 63 characters.
+const LABEL = String.raw`[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?`;
+
+// An exact host (`api.github.com`, `localhost`, `10.0.0.2`) or every host under a domain (`*.github.com`). A wildcard
+// names at least two labels under it, so `*.com` cannot stand in for most of the internet.
+export const SECRET_HOST_PATTERN_RE = new RegExp(String.raw`^(?:\*\.${LABEL}(?:\.${LABEL})+|${LABEL}(?:\.${LABEL})*)$`);
+export const SECRET_HOST_MAX = 253;
+// Enough for a service's API, uploads and content hosts several times over; a list longer than this is no limit.
+export const SECRET_HOSTS_MAX = 64;
+
+const WILDCARD = "*.";
+
+// What a person types or pastes, as the pattern it means: lowercased, trimmed, a trailing dot and a port dropped, and a
+// whole URL reduced to its host. Undefined for anything that is not a host pattern, so a caller refuses it by name.
+export const normalizeHostPattern = (raw: string): string | undefined => {
+    let text = raw.trim().toLowerCase();
+    if (/^[a-z][a-z0-9+.-]*:\/\//.test(text)) {
+        try {
+            text = new URL(text).hostname;
+        } catch {
+            return undefined;
+        }
+    }
+    text = text.replace(/:\d+$/, "").replace(/\.$/, "");
+    return text.length <= SECRET_HOST_MAX && SECRET_HOST_PATTERN_RE.test(text) ? text : undefined;
+};
+
+// A host a use would reach, in the form patterns are written in: lowercased, one trailing dot dropped. Undefined when it
+// is not a plain host name or IPv4 address, which callers read as "cannot tell where this goes".
+export const normalizeHost = (raw: string): string | undefined => {
+    const host = raw.toLowerCase().replace(/\.$/, "");
+    return host.length <= SECRET_HOST_MAX && !host.startsWith(WILDCARD) && SECRET_HOST_PATTERN_RE.test(host) ? host : undefined;
+};
+
+// `*.github.com` matches every host under github.com at any depth, and not github.com itself; anything else matches only
+// itself. Both sides are expected normalized.
+export const hostMatches = (pattern: string, host: string): boolean =>
+    pattern.startsWith(WILDCARD) ? host.endsWith(pattern.slice(1)) : host === pattern;
+
+export const hostAllowed = (patterns: readonly string[], host: string): boolean => patterns.some((pattern) => hostMatches(pattern, host));
+
+// Whether every host `pattern` matches is already matched by `patterns`: an exact host by any pattern that matches it, a
+// wildcard only by itself or a wildcard over a domain above it.
+const covered = (patterns: readonly string[], pattern: string): boolean => {
+    if (!pattern.startsWith(WILDCARD)) {
+        return hostAllowed(patterns, pattern);
+    }
+    const suffix = pattern.slice(1);
+    return patterns.some((held) => held.startsWith(WILDCARD) && suffix.endsWith(held.slice(1)));
+};
+
+// One secret's host guard as a change reads it: whether it asks off the list, and the list. Absent reads as off.
+export interface HostGuardSetting {
+    readonly guard: boolean;
+    readonly hosts: readonly string[];
+}
+
+// Whether going from `current` to `next` only ever makes the agent ask more: turning the guard on, or taking hosts off a
+// guarded list (down to none, where every use asks). The one test for who may make a change: anybody who may use
+// secrets may tighten a guard, only the owner may loosen one, by adding a host or turning it off.
+export const tightensHostGuard = (current: HostGuardSetting | undefined, next: HostGuardSetting): boolean => {
+    if (!next.guard) {
+        return current === undefined || !current.guard;
+    }
+    if (current === undefined || !current.guard) {
+        return true;
+    }
+    return next.hosts.every((pattern) => covered(current.hosts, pattern));
+};

package/src/policy/turned-away.ts

@@ -10,6 +10,7 @@ const TURNED_AWAY: ReadonlySet<string> = new Set([
     "claude-not-entitled",
     "unknown-command",
     "context-window-too-small",
+    "model-helper-only",
     "sandbox-memory-low",
     "trial-unavailable",
     "trial-model-unavailable",

package/src/protocol/raw-routes.ts

@@ -28,6 +28,9 @@ export const RAW_ROUTES = {
     "POST /system/ws-ticket": { beforeBoot: true, floor: "collaborator", control: "never" },
     // A WebSocket upgrade carries no Authorization header; the terminal and both browser wires check a query ticket.
     "GET /system/terminal": { auth: "door", beforeBoot: true, control: "never", front: true },
+    // The front's proof of life (vitals.ts): no credential and nothing of the workspace, readable by any origin, answered
+    // whatever state the daemon is in.
+    "GET /system/vitals": { auth: "door", beforeBoot: true, front: true },
     // Desktop sync's byte pipe, guarded again by sshd's own key check against the same enrollment.
     "GET /system/sync/ssh": { sync: "pipe", control: "never", lane: "bulk" },
     "GET /system/browser-profile": { auth: "door", beforeBoot: true, control: "never" },
@@ -61,6 +64,9 @@ export const RAW_ROUTES = {
     "POST /environment/approve": {},
     "POST /environment/reject": {},
     "POST /environment/runtime-install": {},
+    "POST /environment/remove": {},
+    "POST /environment/rebuild-when-idle": {},
+    "DELETE /environment/rebuild-when-idle": {},
     "GET /engines": {},
     "POST /engines/channel": {},
     "POST /engines/update": {},
@@ -92,13 +98,14 @@ export const RAW_ROUTES = {
     "GET /wallet/status": { agent: true, control: "never" },
     "POST /wallet/fetch": { agent: true, control: "never" },
     "GET /wallet/history": { agent: true, control: "never" },
-    // The `agents` CLI's children: start, follow up, answer (never a consent card), cancel, list.
+    // The `agents` CLI's children: start, follow up, answer (never a consent card), cancel, merge held work, list.
     "POST /children/spawn": { agent: true, control: "never" },
     "GET /children/providers": { agent: true, control: "never" },
     "POST /children/wait": { agent: true, control: "never" },
     "POST /children/send": { agent: true, control: "never" },
     "POST /children/answer": { agent: true, control: "never" },
     "POST /children/cancel": { agent: true, control: "never" },
+    "POST /children/merge": { agent: true, control: "never" },
     "GET /children": { agent: true, control: "never" },
     // The fleet reads, and the one write: words in front of another conversation, which a person can do by typing.
     "GET /fleet": { agent: true },